As the noise defence and NoPeekNN are introduced at the intersection between model segments, they do not protect against white box model inversion, which extracts training data memorised by a data owner's model segment. A training-time differentially private mechanism, such as DP-SGD or PATE [1]}, [2]}, [3]}, could offer protection against those attacks. Additionally, we will quantitatively investigate the privacy-utility trade-off, as explored by [4]}. Furthermore, the compatibility of defensive measures to protect against several possible attacks should be investigated (see Appendix REF  for more details). In that regard, the noise defence may be formulated as a local differential privacy mechanism on the input dataset to the computational server's model part, which may confer additional defensive capability against other attacks, for example, membership inference. The more complex the dataset, the more difficult for an attack model to learn the data reconstruction mapping. The effectiveness of the noise defence in combination with NoPeekNN should be explored on more complex data sources.
